M5 hardening: cross-tenant vault scoping + dialog handling breadth

[gcharang]

Two independent M5 substrate-hardening items, each a self-contained commit.

1. Cross-tenant vault scoping + two-tenant isolation e2e (6a888ff)

Writing the two-tenant isolation e2e surfaced a high-severity cross-tenant credential-exfiltration gap: SessionAgent.fillSecret resolved any caller-supplied secretRef against the single shared KV vault with no tenant scoping, so a consumer authenticated as tenant B — driving its own legitimate session — could fill_secret with secretRef: "vault://tenantA/…" and type tenant A's plaintext into a field B controls. understudy owns the shared vault across tenants, so this check belongs server-side, not in a consumer-side breakwater.

Fix (server-side, non-breaking):

• auth.ts::tenantOf derives a session's authoritative tenant from its HMAC-signed sessionId (never a caller claim); scopeSession delegates to it.
• fillSecret refuses any secretRef outside the session tenant's vault://<tenantId>/… namespace before any vault read, returning the same scrubbed ok:false an absent secret gives (no existence oracle, DL-008).
• isValidTenantId (non-empty, no /) enforced at mintSessionId (fail-closed at session creation) and re-checked in tenantOf, so a /-bearing tenant can't straddle the namespace prefix.

Keeps the vault://<tenant>/ref convention, the deployed vault keys, and the published @understudy/connector@0.2.0 absolute-secretRef contract unchanged.

2. Dialog handling breadth (432e2cc)

A page dialog (alert/confirm/prompt/beforeunload) blocks the single CDP channel, so the extension answers it locally and synchronously (the consumer is never in the response path) and reports it after the fact.

• protocol (→0.5.0): new dialog Event, single-sourced via DialogRecordSchema so extension/backend/connector all derive from one definition.
• extension: type-aware dialogDisposition (alert/beforeunload→accept, confirm/prompt→dismiss) replaces the prior blind dismiss — a beforeunload dismiss was cancelling the automation's own navigations. applyDialogDecision answers before reporting, so the channel is always freed even when the report is a no-op (WS down) or the dialog type is unclassifiable.
• backend: capped SessionState.dialogs, surfaced via GET /v1/sessions/:id.
• connector (→0.3.0): get_dialogs observe read over an egress-guarded GET.

The dialogs surface is best-effort (like page_event): a report emitted while the WS is momentarily down isn't replayed — the dialog is still answered, only its notification is lost. Documented in the protocol/backend comments and plan residual #6; guaranteed-delivery-on-reconnect is a deliberate follow-up.

Verification

• 230 tests pass (protocol 26, extension 56, connector 28, backend 120); typecheck + build clean across all four packages.
• Both changes passed a three-lane review (clean-code, architecture, adversarial QA) with every substantive finding fixed and re-verified.
• A changeset bumps @understudy/protocol and @understudy/connector minor (backend/extension are private, not published).

🤖 Generated with Claude Code